[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #246857 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, May 4, 2026 4:45:57 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #246857 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 246857

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total            Src IP
----------------------------------------------------
  14975400       49918         2.9%    57.144.248.192
  12941100       43137         2.5%    157.240.253.63
  11199000       37330         2.2%    57.144.244.192
   8740800       29136         1.7%     162.159.198.2
   6955500       23185         1.4%     185.109.23.47
   6295500       20985         1.2%      157.240.0.63
   6144000       20480         1.2%   189.203.100.122
   6042000       20140         1.2%     37.114.146.98
   5968500       19895         1.2%   189.113.253.235
   5802300       19341         1.1%       109.9.41.71

Top-10 Dst IPs by Packets:
    Packets   Est. Rate   % of Total            Dst IP
-----------------------------------------------------
  435275400     1450918        85.2%      192.114.52.1
   14847300       49491         2.9%   128.139.225.242
    8758500       29195         1.7%     132.64.244.57
    4641300       15471         0.9%    192.114.91.248
    4445700       14819         0.9%    192.114.91.249
    4433100       14777         0.9%    192.114.91.245
    4254000       14180         0.8%    192.114.91.247
    3642000       12140         0.7%    192.114.91.244
    3566100       11887         0.7%      192.114.52.3
    3540900       11803         0.7%     192.114.52.13

Top-10 Possible Targets by Bytes:
          Src IP   Src Port            Dst IP   Dst Port   Sampled Count
----------------------------------------------------------------------
                                 192.114.52.1                25018703100
                                 192.114.52.1      28754     22768275300
  57.144.248.192        443                                  18370239000
  57.144.248.192                                             18370239000
                              128.139.225.242                15986564700
  157.240.253.63        443                                  15725523000
  157.240.253.63                                             15725523000
                        443   128.139.225.242                14693973000
  57.144.244.192        443                                  13793716500
  57.144.244.192                                             13793716500

Metric Info:
4M UDP Packets/s

Alert Type:
time_window

Alert Description:
High UDP packet rate.

Start Time: 2026-05-04 13:34:53
End Time: ongoing

First Event Seen: 2026-05-04 13:32:00
Last Event Seen: 2026-05-04 13:44:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/246857/